Skip to content
Threat Feed
Subscribe

Product

AWS CLI

2 briefs RSS
high advisory

Detection of Multi-Cloud CLI Token and Credential Harvesting

Threat actors harvest cloud and container platform authentication tokens by abusing legitimate CLI utilities to output secrets to standard streams, which can be detected via anomalous multi-provider access patterns.

Google Cloud SDK +6 credential-access cloud-security supply-chain
2t updated
low advisory

AWS Discovery API Calls via CLI from a Single Resource

A single AWS resource is making multiple read-only discovery API calls via the AWS CLI within a 10-second window, indicating potential reconnaissance attempts using compromised credentials or a compromised instance.

AWS +5 cloudtrail discovery aws-cli threat-detection
2r 3t